Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2019-25726

All in One Video Downloader 1.2 SQL Injection via admin page-edit

All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send requests to the admin interface with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames, databases, and version details.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nicheoffice
Products
All In One Video Downloader
CVE-2019-25727

WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download

WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export_csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ad-manager-wd Wordpress
Products
Ad Manager Wd Wordpress
CVE-2019-25729

PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie

PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP commands through the CSRF-TOKEN cookie parameter. Attackers can craft malicious cookie values containing template injection payloads like shell_exec() to execute system commands and retrieve sensitive information from the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Simcy Creative
Products
Pdf Signer
CVE-2019-25730

Listing Hub CMS 1.0 SQL Injection via pages.php id

Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to pages.php with crafted id values using error-based SQL injection techniques to extract database credentials, usernames, and version information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Themerig
Products
Listing Hub Cms
CVE-2019-25732

PHP EI-Tube Script 3 SQL Injection via search parameter

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to extract sensitive database information including usernames, passwords, and version details.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Eitube
Products
Ei-tube
CVE-2026-5228

Improper Access Control in Kurt Software Studio's WriteUp Mobile App

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Kurt Software Studio
Products
Writeup Mobile App
CVE-2026-41178

OpenTelemetry-Go's baggage parsing no longer caps raw header length

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Opentelemetry
Products
Opentelemetry Opentelemetry-go
CVE-2025-10439

SQLi in Yordam Library Automation System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics Yordam Library Automation System allows SQL Injection. This issue affects Yordam Library Automation System: from 21.5 & 21.6 before 21.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Yordam
Products
Library Automation System
CVE-2025-10449

Path Traversal in Saysis Computer Systems' Saysis Web Portal

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saysis Computer Systems Trade Ltd. Co. Saysis Web Portal allows Path Traversal. This issue affects Saysis Web Portal: from 3.1.9 & 3.2.0 before 3.2.1.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-10463

Improper Authentication in Birtech Information Technologies' Sensaway

Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. This issue affects Senseway: through 09022026.  NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Birtech Information Technologies Industry And Trade
Products
Senseway
CVE-2025-10464

Cleartext password storage in Birtech Information Technologies' Sensaway

Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Birtech Information Technologies Industry And Trade
Products
Senseway
CVE-2025-10465

Unrestricted File Upload in Birtech Information Technologies' Sensaway

Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shell to a Web Server. This issue affects Sensaway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Birtech Information Technologies Industry And Trade
Products
Sensaway
CVE-2025-10467

Stored XSS in Proliz Software's OBS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Stored XSS. This issue affects OBS (Student Affairs Information System): before v25.0401.

CVSS 3.1 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-10468

Path Traversal in Beyaz Computer's CityPLus

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversal. This issue affects CityPlus: before 24.29375.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Beyaz Computer
Products
Cityplus
CVE-2025-10609

Hardcoded Credentials in Logo Software's TigerWings ERP

Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This issue affects TigerWings ERP: from 01.01.00 before 3.03.00.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Logo Software
Products
Tigerwings Erp
CVE-2025-10610

SQLi in SFS Winsure

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure allows Blind SQL Injection. This issue affects Winsure: through Version dated 21.08.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sfs
Products
Winsure
CVE-2025-10612

XSS in GiSoft's City Guide

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in giSoft Information Technologies City Guide allows Reflected XSS. This issue affects City Guide: before 1.4.45.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gisoft
Products
City Guide
CVE-2025-10727

Reflected XSS in ArkSigner's AcBakImzala

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows Reflected XSS. This issue affects AcBakImzala: before v5.1.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Arksigner
Products
Acbakimzala
CVE-2026-6657

CORS Origin Validation Bypass in jupyter-server

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header, which only anchors at the start of the string. This allows attacker-controlled domains such as `trusted.example.com.evil.com` to pass validation against patterns intended to match `trusted.example.com`. The vulnerability affects multiple locations in the codebase, including CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing attacks, arbitrary code execution, and unauthorized access to sensitive API responses.

CVSS 3.1 · 8.8 High EPSS 5.2% KEV · Not listed
Vendors
Jupyter
Products
Jupyter Server